Perform pseudo-filesystem permission checks inside inode_reserve() and
inode_remove() while the inode tree lock is held, and hold that lock across
pseudorename mutations so symlink swaps cannot bypass directory checks.
Hold a read lock around pseudo-fs open permission checks.
On setuid/setgid exec, update saved set-IDs, mark the task group secure,
sanitize dangerous environment variables, clear debug/dumpable flags, and
add issetugid(), secure_getenv(), and PR_SET/GET_DUMPABLE support.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
posix_spawnattr_init() no longer pre-fills attr->stacksize and
attr->priority (it leaves them zero, as memset already does). When a
caller does not set them, the binary loader supplies them from the
loaded ELF (binp->stacksize / binp->priority, parsed from the nx_*
symbols), and nxtask_spawn_exec() falls back to the parent priority and
CONFIG_POSIX_SPAWN_DEFAULT_STACKSIZE for the posix_spawn() function-task
path.
This lets an application's stack size and priority embedded as ELF
symbols actually drive the spawned task, instead of being overridden by
the spawnattr defaults.
Signed-off-by: anjiahao <anjiahao@xiaomi.com>
Correct build errors when CONFIG_ENABLE_ALL_SIGNALS is not defined
- sched makefiles: Move pending-signal helpers from the ENABLE_ALL_SIGNALS-only
list to the !DISABLE_ALL_SIGNALS list so signal dispatch is available in
PARTIAL builds sched: make SIG_PREALLOC_ACTIONS, SIG_ALLOC_ACTIONS and
SIG_DEFAULT depend on ENABLE_ALL_SIGNALS
- sched: fix ifdefs around pending-signal queue access and signal-mask for
PARTIAL/DISABLE modes
- arch: gate SYS_signal_handler / _return calls and SYSCALL_LOOKUP(signal)
with ENABLE_ALL_SIGNALS
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
debug.h is a NuttX-specific, non-POSIX header. Placing it in the
top-level include/ directory creates naming conflicts with external
projects that define their own debug.h.
This commit moves the canonical header to include/nuttx/debug.h,
following the NuttX convention for non-POSIX/non-standard headers,
and updates all in-tree references.
A backward-compatibility shim is left at include/debug.h that
emits a deprecation #warning and re-includes <nuttx/debug.h>,
allowing out-of-tree code to continue building while migrating.
Signed-off-by: Piyush Patle <piyushpatle228@gmail.com>
Fix violations of MISRA C:2012 Rule 10.4 (operand of unsigned and signed)
in cancellation point handling code.
Changed all CANCEL_FLAG_* macro definitions and their usage to use unsigned
literals (1u instead of 1) to ensure consistent unsigned arithmetic when
performing bitwise operations. This eliminates mixed signed/unsigned operand
violations in:
- CANCEL_FLAG_NONCANCELABLE
- CANCEL_FLAG_CANCEL_ASYNC
- CANCEL_FLAG_CANCEL_PENDING
The changes affect cancellation point entry/exit logic, cancellation state
management, and cancellation type handling across both kernel and libc
implementations.
Signed-off-by: fangxinyong <fangxinyong@xiaomi.com>
Fix violations of MISRA C:2012 Rule 10.4 (essential type operand of
unsigned and signed) in posix_spawn attribute handling code.
Changed all POSIX_SPAWN_* flag macro definitions to use unsigned literals
(1u instead of 1) to ensure consistent unsigned arithmetic when performing
bitwise operations. This eliminates mixed signed/unsigned operand violations
in the following flags:
- POSIX_SPAWN_RESETIDS
- POSIX_SPAWN_SETPGROUP
- POSIX_SPAWN_SETSCHEDPARAM
- POSIX_SPAWN_SETSCHEDULER
- POSIX_SPAWN_SETSIGDEF
- POSIX_SPAWN_SETSIGMASK
- POSIX_SPAWN_SETSID
Updated all flag checking comparisons in spawn_execattrs() to compare
against 0u instead of 0 for consistency.
Signed-off-by: fangxinyong <fangxinyong@xiaomi.com>
Move pthread mutex operations from kernel-space syscall
interface to user-space implementations
to reduce syscall overhead. Relocate mutex holder list
tracking from task control block (tcb) to
thread local storage (tls) to improve memory layout and
cache efficiency. Add helper macros for
conditional mutex implementations and update syscall
interface accordingly.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Refactor nxtask_setup_stackargs() to use a single ret exit path.
Avoid partially-initialized state on error paths and improve readability.
Addresses Coverity HIS_metric_violation: RETURN.
Signed-off-by: fangxinyong <fangxinyong@xiaomi.com>
Initialize ret and propagate scheduler/param errors via a single return.
Make spawn_file_is_duplicateable() decision explicit using a dup state.
Addresses Coverity HIS_metric_violation: RETURN.
Signed-off-by: fangxinyong <fangxinyong@xiaomi.com>
Replace early return with a ret flag to unify the exit path.
Keep critical section behavior unchanged while simplifying control flow.
Addresses Coverity HIS_metric_violation: RETURN.
Signed-off-by: fangxinyong <fangxinyong@xiaomi.com>
Use a local ret variable and return once at the end.
This keeps the IDLE_PROCESS_ID fallback behavior unchanged.
Addresses Coverity HIS_metric_violation: RETURN.
Signed-off-by: fangxinyong <fangxinyong@xiaomi.com>
Add pid field to task_info_s and move getpid() implementation to user
space TLS access. Remove getpid from syscall interface as it now returns
cached PID from thread local storage instead of kernel lookup.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Move tls_dup_info() call to after child process priority is set, ensuring
the child's pid is properly initialized before duplicating TLS information.
This fixes incorrect thread ID assignment during task fork operations.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Move nxsched_switch_context() call after setting TSTATE_TASK_INACTIVE to ensure
proper IRQ count state before context switching, preventing assertion failures
in enter_critical_section() when rtcb->irqcount is incorrectly zero during termination.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Move kernel stack allocation from exec_module() (binary format execution) to
nxtask_init() (task initialization) with proper type checking. Add conditional
check to allocate kernel stack only for non-kernel tasks (ttype != TCB_FLAG_TTYPE_KERNEL).
Enables kernel stack allocation for both exec'd tasks and regular task_create()
calls in protected builds, allowing userspace to create tasks with proper kernel
stack isolation.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Signals in NuttX serve two primary purposes:
1. Synchronization and wake-up:
Signals can be used to block threads on specific signal sets and later
wake them up by delivering the corresponding signals to those threads.
2. Asynchronous notification:
Signals can also be used to install callback handlers for specific signals, allowing threads to
asynchronously invoke those handlers when the signals are delivered.
This change introduces the ability to disable all signal functionality to reduce footprint for NuttX.
Signed-off-by: Chengdong Wang wangchengdong@lixiang.com
Signals in NuttX serve two primary purposes:
1. Synchronization and wake-up:
Signals can be used to block threads on specific signal sets and later
wake them up by delivering the corresponding signals to those threads.
2. Asynchronous notification:
Signals can also be used to install callback handlers for specific signals, allowing threads to
asynchronously invoke those handlers when the signals are delivered.
This change introduces the ability to partially disable signal functionality: to disable only signal functions for
Asynchronous notification, keeping functions for Synchronization and wake-up.
This enables finer-grained control over signal usage while preserving existing behavior for supported use cases.
Co-authored-by: Guo Shichao guoshichao@xiaomi.com
Signed-off-by: Chengdong Wang wangchengdong@lixiang.com
Move addrenv_join() call after group_initialize() in nxtask_setup_fork() to fix
null pointer dereference. addrenv_join() accesses child->group which is
initialized by group_initialize(), so the operations must be sequenced
correctly. Reorder initialization to ensure child task group is set up before
address environment join operations.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
The TCB initializes the pid early, but the argvstack is not initialized
at that time. This may cause invalid addresses to be obtained when
nxsched_get_stackargs is called during task enumeration.
Initialize the argv pointer to NULL to enable safe validity checks.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
Since the task and group structures are no longer allocated in the same space, the memory for group is allocated in the group_allocate() function, and no further allocation is needed during the task allocation process.
Signed-off-by: wangzhi16 <wangzhi16@xiaomi.com>
This reverts commit 29e50ffa73.
reason:
Placing the main thread and the gourd in the same memory block, and allocating and freeing memory simultaneously, presents the following two problems：
When the main thread creates a child thread and performs a detach operation, there is a possibility that the main thread may have exited, but the main thread's TCB (Transaction Control Block) may not have been released.
This could potentially cause the main thread's TCB to be double-freed. The core contradiction in this problem lies in binding the main thread's TCB (Trust Container Registry) and the group together. When releasing the main thread's TCB, an additional check is needed to ensure the main thread was the last to leave the group. If this check and the free operation are atomically guaranteed, the logic is sound, and double freeing won't occur. However, this atomicity cannot be completely guaranteed. If other free operations cause a block, problems still arise.
Signed-off-by: wangzhi16 <wangzhi16@xiaomi.com>
If the thread is blocked waiting on a event, then the
thread must be unblocked from the evnet to handle
the task cancellation.
Signed-off-by: Chengdong Wang wangchengdong@lixiang.com
Currently, there is duplicated code in nxsig_wait_irq() and nxsig_timeout().
This patch updates the input parameters of nxsig_wait_irq() so that it can
be reused in nxsig_timeout(), reducing code duplication and improving
maintainability.
Signed-off-by: Chengdong Wang <wangchengdong@lixiang.com>
Replace all nxsched_suspend/resume_*** with nxsched_switch_context
Delete nxsched_resume_scheduler in up_exit and call it uniformly in task_exit
Co-authored-by: yinshengkai <yinshengkai@xiaomi.com>
Signed-off-by: guoshengyuan1 <guoshengyuan1@xiaomi.com>
When the task has TCB_FLAG_CPU_LOCKED it is locked to the CPU regardless
of the affinity. There is no need to switch the affinity back and forth.
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
Change every occurence of up_switch_context to use this_task() as the first parameter.
"nxsched_add_readytorun" returns "true" if context switch is required. "nxsched_add_readytorun"
typically could only switch the assigned/running task to the one which is passed in as parameter.
But this is not strictly guaranteed in SMP; if other CPUs tweak with affinities or priorities,
it may be possible that the running task after the call is changed, but is some other
task from the readytorun list (and it should be, if there is higher priority one available or the
affinity of the added task prevents it to be scheduled in, but the previous head of the readytorun
list should run.
this_task() is always the correct one to switch to, since it always points to the tcb which was
just switched in by the nxsched_add_readytorun.
This is also a precursor to re-writing the SMP queue logic to remove pending lists for SMP.
Signed-off-by: Jukka Laitinen <jukka.laitinen@tii.ae>
This patch is a rework of the NuttX file descriptor implementation. The
goal is two-fold:
1. Improve POSIX compliance. The old implementation tied file description
to inode only, not the file struct. POSIX however dictates otherwise.
2. Fix a bug with descriptor duplication (dup2() and dup3()). There is
an existing race condition with this POSIX API that currently results
in a kernel side crash.
The crash occurs when a partially open / closed file descriptor is
duplicated. The reason for the crash is that even if the descriptor is
closed, the file might still be in use by the kernel (due to e.g. ongoing
write to file). The open file data is changed by file_dup3() and this
causes a crash in the device / drivers themselves as they lose access to
the inode and private data.
The fix is done by separating struct file into file and file descriptor
structs. The file struct can live on even if the descriptor is closed,
fixing the crash. This also fixes the POSIX issue, as two descriptors
can now point to the same file.
Signed-off-by: Ville Juven <ville.juven@unikie.com>
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
For some SMP calls it is necessary to lock the current CPU for the process
receiving the SMP call. This is done by setting the CPU affinity to the
current CPU and preventing the CPU selection algorithm from switching
CPUs.
dtcb->flags |= TCB_FLAG_CPU_LOCKED;
CPU_SET(dtcb->cpu, &dtcb->affinity);
However, this logic is currently broken, as CPU_SET is defined as:
#define CPU_SET(c,s) do { *(s) |= (1u << (c)); } while (0)
In order to assign tcb->cpu (the current CPU) to the affinity mask, the
mask must be cleared first by calling CPU_ZERO.
test:
1.use mps3-an547 build helloxx as module and run it
2.use qemu-armv7a:knsh test kernel build helloxx and run it
Signed-off-by: anjiahao <anjiahao@xiaomi.com>
There is no need for a gettid() syscall, as the thread ID is stable through
the life of the process. It is safe to put a copy of TID to TLS. This way
a user processes can access TID quickly via its own stack, instead of
having to use an expensive syscall.
Signed-off-by: Ville Juven <ville.juven@unikie.com>
reason:
The old implementation of the SMP call, even when using the "no wait" parameter,
could still result in waiting, if invoking it within a critical section
may lead to deadlocks. Therefore, in order to implement a truly asynchronous SMP
call strategy, we have added nxsched_smp_call_async.
Signed-off-by: hujun5 <hujun5@xiaomi.com>
The comment about the CPU index remaining stable is incorrect. There is no
guarantee the task does not yield during the exit process, meaning the CPU
can most definitely change. Also, there is no reason why it should not be
allowed to change.
This fixes a full system crash during process exit when the CPU changes
and we query the current task from the old CPU.
after
text data bss dec hex filename
269732 51065 63335 384132 5dc84 nuttx
before
text data bss dec hex filename
269784 51065 63335 384184 5dcb8 nuttx
size -50
Signed-off-by: hujun5 <hujun5@xiaomi.com>
